Amazon Amazon Certifications CLF-C02 Questions & Answers

• Question 201:

  Which AWS service or storage class provides low-cost, long-term data storage?

  A. Amazon S3 Glacier Deep Archive

  B. AWS Snowball

  C. Amazon MQ

  D. AWS Storage Gateway

  Correct Answer: A

  Amazon S3 Glacier Deep Archive is a storage class within Amazon S3 that provides the lowest-cost, long-term data storage for data that is rarely accessed. AWS Snowball is a service that provides a physical device for transferring large amounts of data into and out of AWS. Amazon MQ is a service that provides managed message broker service for Apache ActiveMQ. AWS Storage Gateway is a service that provides hybrid cloud storage for on-premises applications.

• Question 202:

  Which AWS service provides storage that can be mounted across multiple Amazon EC2 instances?

  A. Amazon Workspaces

  B. Amazon Elastic File System (Amazon EFS)

  C. AWS Database Migration Service (AWS DMS)

  D. AWS Snowball Edge

  Correct Answer: B

  Amazon EFS is a fully managed service that provides scalable and elastic file storage for multiple Amazon EC2 instances. Amazon EFS supports the Network File System (NFS) protocol, which allows multiple EC2 instances to access the same file system concurrently. You can learn more about Amazon EFS from this webpage or this digital course.

• Question 203:

  A company is planning to migrate to the AWS Cloud. The company is conducting organizational transformation and wants to become more responsive to customer inquiries and feedback.

  Which tasks should the company perform to meet these requirements, according to the AWS Cloud Adoption Framework (AWS CAF)? (Select TWO.)

  A. Realign teams to focus on products and value streams.

  B. Create new value propositions with new products and services.

  C. Use agile methods to rapidly iterate and evolve.

  D. Use a new data and analytics platform to create actionable insights.

  E. Migrate and modernize legacy infrastructure.

  Correct Answer: AC

  Realigning teams to focus on products and value streams, and using agile methods to rapidly iterate and evolve are tasks that the company should perform to meet the requirements of becoming more responsive to customer inquiries and feedback, according to the AWS Cloud Adoption Framework (AWS CAF). AWS CAF organizes guidance into six areas of focus, called perspectives: business, people, governance, platform, security, and operations. Each perspective is divided into capabilities, which describe the skills and processes to execute the transition effectively. The people perspective helps you prepare your organization for cloud adoption, and includes capabilities such as organizational change management, staff skills and readiness, and organizational alignment. The business perspective helps you align IT strategy with business strategy, and includes capabilities such as business case development, value proposition, and product ownership. Creating new value propositions with new products and services is a task that belongs to the business perspective, but it is not directly related to the requirement of becoming more responsive to customer inquiries and feedback. Using a new data and analytics platform to create actionable insights is a task that belongs to the platform perspective, which helps you design, implement, and optimize the architecture of the AWS environment. However, it is also not directly related to the requirement of becoming more responsive to customer inquiries and feedback. Migrating and modernizing legacy infrastructure is a task that belongs to the operations perspective, which helps you enable, run, use, operate, and recover IT workloads to the level agreed upon with your business stakeholders. However, it is also not directly related to the requirement of becoming more responsive to customer inquiries and feedback.

• Question 204:

  A company needs to implement identity management for a fleet of mobile apps that are running in the AWS Cloud.

  Which AWS service will meet this requirement?

  A. Amazon Cognito

  B. AWS Security Hub

  C. AWS Shield

  D. AWS WAF

  Correct Answer: A

  Amazon Cognito is a service that provides identity management for mobile and web applications, allowing users to sign up, sign in, and access AWS resources with different identity providers. AWS Security Hub is a service that provides a comprehensive view of the security posture of AWS accounts and resources. AWS Shield is a service that provides protection against distributed denial of service (DDoS) attacks. AWS WAF is a web application firewall that helps protect web applications from common web exploits.

• Question 205:

  A company is assessing its AWS Business Support plan to determine if the plan still meets the company's needs. The company is considering switching to AWS Enterprise Support.

  Which additional benefit will the company receive with AWS Enterprise Support?

  A. A full set of AWS Trusted Advisor checks

  B. Phone, email, and chat access to cloud support engineers 24 hours a day, 7 days a week

  C. A designated technical account manager (TAM) to assist in monitoring and optimization

  D. A consultative review and architecture guidance for the company's applications

  Correct Answer: C

  The additional benefit that the company will receive with AWS Enterprise Support is C. A designated technical account manager (TAM) to assist in monitoring and optimization. A TAM is a dedicated point of contact who works with the customer to understand their use cases, applications, and goals, and provides proactive guidance and best practices to help them optimize their AWS environment. A TAM also helps the customer with case management, escalations, service updates, and feature requests12. A full set of AWS Trusted Advisor checks is available for customers with Business, Enterprise On-Ramp, or Enterprise Support plans1. Phone, email, and chat access to cloud support engineers 24/7 is available for customers with Business, Enterprise On-Ramp, or Enterprise Support plans1. A consultative review and architecture guidance for the company's applications is available for customers with Enterprise On-Ramp or Enterprise Support plans1. Therefore, these benefits are not exclusive to AWS Enterprise Support. Reference:

  1: AWS Support Plan Comparison | Developer, Business, Enterprise ...

• Question 206:

  A company is running a workload in the AWS Cloud.

  Which AWS best practice ensures the MOST cost-effective architecture for the workload?

  A. Loose coupling

  B. Rightsizing

  C. Caching

  D. Redundancy

  Correct Answer: B

  The AWS best practice that ensures the most cost-effective architecture for the workload is rightsizing. Rightsizing means selecting the most appropriate instance type or resource configuration that matches the needs of the workload. Rightsizing can help optimize performance and reduce costs by avoiding over-provisioning or under- provisioning of resources1. Loose coupling, caching, and redundancy are other AWS best practices that can improve the scalability, availability, and performance of the workload, but they do not necessarily ensure the most cost-effective architecture.

• Question 207:

  Which Amazon S3 storage class is the MOST cost-effective for long-term storage?

  A. S3 Glacier Deep Archive

  B. S3 Standard

  C. S3 Standard-Infrequent Access (S3 Standard-IA)

  D. S3 One Zone-Infrequent Access (S3 One Zone-IA)

  Correct Answer: A

  Amazon S3 Glacier Deep Archive is the lowest-cost storage class in the cloud. It is designed for long-term data archiving that is rarely accessed. It offers a retrieval time of 12 hours and a durability of 99.999999999% (11 9's). It is ideal for data that must be retained for 7 years or longer to meet regulatory compliance requirements.

• Question 208:

  A company is building an application on AWS. The application needs to comply with credit card regulatory requirements. The company needs proof that the AWS services and deployment are in compliance.

  Which actions should the company take to meet these requirements? (Select TWO.)

  A. Use Amazon Inspector to submit the application for certification.

  B. Ensure that the application's underlying hardware components comply with requirements.

  C. Use AWS Artifact to access AWS documents about the compliance of the services.

  D. Get the compliance of the application certified by a company assessor.

  E. Use AWS Security Hub to certify the compliance of the application.

  Correct Answer: CD

  Using AWS Artifact to access AWS documents about the compliance of the services, and getting the compliance of the application certified by a company assessor are actions that the company should take to meet the requirements of complying with credit card regulatory requirements. AWS Artifact is a service that provides on-demand access to AWS security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. AWS Artifact can help you demonstrate compliance with credit card regulatory requirements by providing you with proof that the AWS services and deployment are in compliance. Getting the compliance of the application certified by a company assessor is an action that the company should take to ensure that the application meets the specific requirements of the credit card industry. A company assessor is an independent third-party entity that is qualified to assess the compliance of the application with the relevant standards and regulations. Using Amazon Inspector to submit the application for certification is not an action that the company should take, because Amazon Inspector is a service that helps you improve the security and compliance of your applications deployed on AWS by automatically assessing them for vulnerabilities and deviations from best practices, but it does not provide certification for the applications. Ensuring that the application's underlying hardware components comply with requirements is not an action that the company should take, because the application is deployed on AWS, and AWS is responsible for the security and compliance of the underlying hardware components. This is part of the shared responsibility model, where AWS is responsible for security of the cloud, and customers are responsible for security in the cloud. Using AWS Security Hub to certify the compliance of the application is not an action that the company should take, because AWS Security Hub is a service that gives you a comprehensive view of your security posture across your AWS accounts and helps you check your environment against security industry standards and best practices, but it does not provide certification for the applications.

• Question 209:

  A company deployed an application on an Amazon EC2 instance. The application ran as expected for 6 months. In the past week, users have reported latency issues. A system administrator found that the CPU utilization was at 100% during business hours. The company wants a scalable solution to meet demand.

  Which AWS service or feature should the company use to handle the load for its application during periods of high demand?

  A. Auto Scaling groups

  B. AWS Global Accelerator

  C. Amazon Route 53

  D. An Elastic IP address

  Correct Answer: A

  Auto Scaling groups are a feature that allows users to automatically scale the number of Amazon EC2 instances up or down based on demand or a predefined schedule. Auto Scaling groups can help improve the performance and availability of applications by adjusting the capacity in response to traffic fluctuations1. AWS Global Accelerator is a service that improves the availability and performance of applications by routing traffic through AWS edge locations2. Amazon Route 53 is a service that provides scalable and reliable domain name system (DNS) service3. An Elastic IP address is a static IPv4 address that can be associated with an Amazon EC2 instance4.

• Question 210:

  A company wants a list of all users in its AWS account, the status of all of the users' access keys, and if multi-factor authentication (MFA) has been configured.

  Which AWS service or feature will meet these requirements?

  A. AWS Key Management Service (AWS KMS)

  B. IAM Access Analyzer

  C. IAM credential report

  D. Amazon CloudWatch

  Correct Answer: C

  IAM credential report is a feature that allows you to generate and download a report that lists all IAM users in your AWS account and the status of their various credentials, including access keys and MFA devices. You can use this report to

  audit the security status of your IAM users and ensure that they follow the best practices for using AWS1.

  AWS Key Management Service (AWS KMS) is a service that allows you to create and manage encryption keys to protect your data. It does not provide information about IAM users or their credentials2.

  IAM Access Analyzer is a feature that helps you identify the resources in your AWS account, such as S3 buckets or IAM roles, that are shared with an external entity. It does not provide information about IAM users or their credentials3.

  Amazon CloudWatch is a service that monitors and collects metrics, logs, and events from your AWS resources and applications. It does not provide information about IAM users or their credentials4.

  References:

  Getting credential reports for your AWS account - AWS Identity and Access Management

  AWS Key Management Service - Amazon Web Services

  IAM Access Analyzer - AWS Identity and Access Management Amazon CloudWatch - Amazon Web Services